Ensure no owner account API key exists

ВысокийУровень 1Ручная проверкаibmcloud

Описание

API keys by definition allow access to your account and resources in your account. The API key authenticates the identity and allows all access assigned to the identity for which it was created, therefore an API key created by user with administrative privileges has administrative level access to resources in the account. In accordance with the practice of granting least privilege, API keys should not be created by an account owner because of the level of privilege automatically granted to account-owner created API keys.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

To check for the existence of an API key created by an administrative user, complete the following steps. 1. Login as any administrative user at cloud.ibm.com 2. Click Manage, Access (IAM) 3. Click API keys 4. Check for any API keys that appear under the My IBM Cloud API keys view

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To delete an API key, complete the following steps: 1. Login as the administrative user at cloud.ibm.com 2. In the console, go to Manage, Access (IAM) 3. Click on API keys 4. Identify the row of the API key that you want to delete and select Delete from the Actions List of actions icon menu (found on the right hand side of the row). 5. Then, confirm the deletion by clicking Delete. 6. If you have scenarios where you need a higher level of access, then you should setup a Trusted Profile with these privileges and use it with a less privileged identity

Свойства

Операционные системы: Любая
Теги: cloudcryptoibmcloud
Источник: CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.5 Ensure no owner account API key exists